Configure LDAP global settings in jenkins - jenkins

Question

I've set up a Jenkins instance, and am trying to set up LDAP and getting this error
Unable to connect to ldaps://server.domain.com:636 :
javax.naming.CommunicationException: server.domain.com:636 [Root
exception is javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to
find valid certification path to requested target]
The target server is using a self-signed certificate. Is there a way to disable certification checking? In another web server instance, we run it with
AUTH_LDAP_GLOBAL_OPTIONS = {
ldap.OPT_X_TLS_REQUIRE_CERT: False }
Could there be a similar option when using Jenkins?

Answer 1

You can override the Java default SSL factory like https://plugins.jenkins.io/skip-certificate-check
Or you can trust the cert by fetching the certificate public key and importing that into your ./jre/lib/security/cacert truststore.
export JAVA_HOME='/path/to/your/jre'
export LDAPHOST='LDAPHOST01.domain.ccTLD'
export LDAPSSLPORT='636'
export CERTFILENAME='/tmp/ldapcert.cer'
echo "" | openssl s_client -connect $LDAPHOST:$LDAPSSLPORT 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > $CERTFILENAME
keytool -import -trustcacerts -alias $LDAPHOST -file $CERTFILENAME -keystore $JAVA_HOME/lib/security/cacerts
When you import the certificate, you will be asked for the keystore password. The default is 'changeit' ... otherwise whatever you've changed it to. Details on the cert will be displayed, and you will be asked if you really want to trust the certificate.
[lisa#linux02 checkSSLCertExpiry]# keytool -import -trustcacerts -alias $LDAPHOST -file $CERTFILENAME -keystore $JAVA_HOME/lib/security/cacerts
Enter keystore password:
Owner: CN=LDAPHOST01
Issuer: CN=LDAPHOST01
Serial number: 3a2542463f2d59bb4018f9e9179dd6a8
Valid from: Mon Jun 02 16:55:08 EDT 2014 until: Sun Jun 02 16:55:08 EDT 2019
Certificate fingerprints:
MD5: C3:33:62:B4:A8:30:05:54:3A:F9:AE:99:66:35:EB:22
SHA1: FA:C2:7B:5D:BF:74:05:58:EF:37:F1:AD:8D:8B:DF:02:93:4C:D8:7E
SHA256: BE:D6:DF:A9:4F:82:6B:AF:2C:C7:45:9B:B7:A4:0A:B4:9A:81:DB:8E:49:A2:38:16:49:83:F7:4C:D5:EC:61:E0
Signature algorithm name: SHA1withRSA
Subject Public Key Algorithm: 2048-bit RSA key
...
#4: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: LDAPHOST01
DNSName: LDAPHOST01.domain.ccTLD
]
Trust this certificate? [no]: yes
Certificate was added to keystore
A keytool command to verify the certificate exists in the store:
[lisa#linux02 checkSSLCertExpiry]# keytool -list -keystore $JAVA_HOME/lib/security/cacerts -alias $LDAPHOST
Enter keystore password:
LDAPHOST01.domain.ccTLD, Sep 28, 2018, trustedCertEntry,
Certificate fingerprint (SHA1): FA:C2:7B:5D:BF:74:05:58:EF:37:F1:AD:8D:8B:DF:02:93:4C:D8:7E
Overriding Java's default trust mechanisms is once-and-done, but obviously removes all of the security that goes with verifying a certificate. Trusting the LDAP server's cert means you'll need to know every time the cert is renewed, and you'll need to import the new certificate into your cacerts file.
To avoid having auth fail every year or two when the directory server cert expires, I set up a certificate authority (CA) with a fairly long (10 years or so) validity. You can do this with a dedicated PKI infrastructure or simply OpenSSL. By importing the CA's public key into cacerts, you trust any certificate issued against the CA. So if the directory certificate is renewed every year, you don't need to do anything. In a decade when the CA cert is replaced, you'll need to add the new CA cert to the store.